Bug #4719
closed
IKEv2 to Cisco ASA results in TS mismatch when initiation triggered by traffic
0%
Description
IKEv2 to Cisco ASA won't come up when initiation is triggered by traffic matching the P2. It results in the following on the ASA.
Local:172.27.44.49:500 Remote:172.27.44.26:500 Username:172.27.44.26 IKEv2 Tunnel rejected: Crypto Map Policy not found for remote traffic selector 192.168.152.0/192.168.152.255/0/65535/0 local traffic selector 192.168.25.0/192.168.25.255/0/65535/0!
But if you run 'ipsec up con1', it comes up and works fine. It also rekeys fine on its own.
Updated by Chris Buechler almost 9 years ago
- Assignee set to Chris Buechler
- Target version changed from 2.2.3 to 2.3
this is still replicable as described, but only with ASAs, and only as initiator when triggered by traffic. Manually connecting it is fine, it's fine if it's responder, it rekeys no problem indefinitely. Google GCE cloud VPNs, various strongswan versions on Linux all fine. openiked doesn't work with PSK apparently so not an exactly comparable test with certs, but it works too. Will revisit.
Updated by Jim Thompson over 8 years ago
can you retry this with a recent version of strongswan?
Updated by Jim Thompson over 8 years ago
- Priority changed from Very High to Normal
I'm turning this down to "Normal". It can't be "Very High" if we've released N times in the past 5 months.
Updated by Chris Buechler over 8 years ago
- File asa-failed.pcap added
- File asa-works.pcap added
- File asa-failed.txt added
- File asa-works.txt added
- Affected Version changed from 2.2.2 to 2.2.x
Still the same issue with latest strongswan. Attaching some ASA logs and pcaps. I'll give Linux a shot again to compare.
Updated by Jim Thompson over 8 years ago
Bump to see if linux testing revealed anything.
Updated by Chris Buechler about 8 years ago
- Target version deleted (
2.3)
details of what's happening here:
https://wiki.strongswan.org/issues/1313
Updated by Jim Thompson about 8 years ago
"Affected version is 2.2.2 and 2.2.3."
Does this not affect 2.3?
Updated by Chris Buechler about 8 years ago
Jim Thompson wrote:
"Affected version is 2.2.2 and 2.2.3."
Does this not affect 2.3?
I removed that from the original description as that didn't seem to be true, every version with strongswan does the same here including 2.3.
Updated by Chris Buechler about 8 years ago
- Status changed from Confirmed to Resolved
- Target version set to 2.3
fixed, thanks to Tobias Brunner on the strongswan ticket for pointing out a charon config option I missed.